From d3bf06dce71e338c9d562df716d91c3cddd27368 Mon Sep 17 00:00:00 2001 From: cato447 Date: Mon, 20 Apr 2026 01:16:28 +0200 Subject: [PATCH] fix: changed current_course to be in line with the normal app --- app/blueprints/admin/routes.py | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/app/blueprints/admin/routes.py b/app/blueprints/admin/routes.py index 621406d..7188647 100644 --- a/app/blueprints/admin/routes.py +++ b/app/blueprints/admin/routes.py @@ -1,6 +1,6 @@ from typing import cast, List from flask import render_template, current_app, redirect, url_for, request, abort, session, flash -from app.utils import get_active_banner, get_course, generate_password, get_available_decks, get_passwords, get_all_courses, is_safe_url, get_token, create_token, retrieve_token, set_cookie +from app.utils import get_active_banner, get_course, generate_password, get_available_decks, get_passwords, get_all_courses, is_safe_url, get_token, create_token, retrieve_token, set_cookie, token_required from app.models import db, InfoBanner, Password, Deck from app.forms import InfoBannerForm, DeckForm, PasswordForm, LoginForm from app.auth import user_loader, check_password @@ -50,8 +50,9 @@ def admin_login(): @admin_bp.route("/", methods=["GET", "POST"]) @flask_login.login_required -def admin(): - active_course = get_course(flask_login.current_user.active_course_id) +@token_required +def admin(token): + active_course = get_course(token.active_course) if active_course is None: current_app.logger.error( f"Admin user {flask_login.current_user.id} has no active_course_id." @@ -119,10 +120,11 @@ def admin(): @admin_bp.route("/switch_course/", methods=["POST"]) @flask_login.login_required -def switch_course_admin(new_course: int): +@token_required +def switch_course_admin(new_course: int, token): user = flask_login.current_user if get_course(new_course): - user.active_course_id = new_course + token.active_course = new_course db.session.commit() current_app.logger.info(f"Admin {user.id} switched to course ID {new_course}") return redirect(url_for("admin.admin"))